INTELLIGENT CONTROL ZHC4931 User manual

ZHC4931
User Manual
V1.0

ZH Intelligent Control—4G.RTU
ZHC4931
User Manual
CHENGDU ZONGHENG INTELLIGENT CONTROL CO., LTD.
All rights reserved

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd www.iotrouter.com
Functions
◆Support 1 relay outputs
◆Support 2 DI (dry / wet node) inputs
◆Support analog (current) inputs
◆Support 8 conditional control instructions for more convenient control
◆Support 1 RS485 / RS232（Only choose one）
◆Support serial heartbeat package
◆Support multiple function codes：01、02、03、04、05、06、0F、10
◆Support setting direction of data report
◆Support TCP_Client、HTTP_Client
◆Support 2 working modes：master mode, slave mode，master mode supports
RS485 cascading multiple Modbus devices
◆Compatible with Modbus RTU/TCP
◆Support cloud forwarding and cloud networking
◆Support local and remote upgrade
◆Support hardware watchdog
◆Multiple indicators show working status
◆Support domain name address resolution
◆Support setting APN
◆Support signal quality inquiry
◆Support SIM card number query
◆Support heartbeat package
◆Support registration package in any format to ensure the legality and
uniqueness of the device identity
◆Provide one switch output
◆Relay adopts photoelectric isolation
◆Relay keeps long open and close status
◆Support timing flip status
◆Support setting relay start status
◆ZHC4931G supports GPS
Note: * indicates under development

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd Iwww.iotrouter.com
CONTENT
Before the declaration, the company has the right to change the contents of this manual according
to the needs of technological development..........................................................................................I
The copyright of this manual belongs to Chengdu Zongheng Intelligent Control Technology Co.,
Ltd. Anyone who reproduces it without our written consent will bear the corresponding legal
responsibility........................................................................................................................................I
1.Product Description..........................................................................................................................1
2.Quick start........................................................................................................................................ 2
3.Product Features...............................................................................................................................6
Upgrade steps.................................................................................................................................... 16
Inquire：55 03 00 12 00 01 29 DB...................................................................................................20
Setting example................................................................................................................................. 26
Effect:................................................................................................................................................ 27
4.Applications....................................................................................................................................43
Steps.................................................................................................................................................. 49
Step 2:................................................................................................................................................50
5.Modbus Instruction frame.............................................................................................................. 52
6.Update History............................................................................................................................... 53
7.CONTACT US...............................................................................................................................53

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd Iwww.iotrouter.com
Foreword
Thank you for using the ZHC4931 RTU product provided by Chengdu Zongheng
Intelligent Control Technology Co., Ltd.
Please read this user manual carefully before using to understand the powerful functions
of the product and detailed description of various parameters.
If you encounter problems during use, you can submit to our customer support center.
Whatsapp/TEL:[phone]
Web: www.iotrouter.com
This product is mainly used for GSM / GPRS / CDMA / WCDMA / LTE wireless data
communication. For specific technical specifications and performance parameters, please
refer to the "ZHC4931 Specification".
This manual aims to explain some software parameters and equipment function
mechanism of ZHC4931. It is recommended that users read this manual carefully before
using this product, in order to quickly understand the product usage method and work flow.
Copyright Notice
Before the declaration, the company has the right to change the contents of this manual
according to the needs of technological development.
The copyright of this manual belongs to Chengdu Zongheng Intelligent Control
Technology Co., Ltd. Anyone who reproduces it without our written consent will bear the
corresponding legal responsibility.
Version Information
Document name: ZHC4931 User Manual
Version: v1.0

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd II www.iotrouter.com
Modification date: June 14, 2019
Relevant information
“ZHC4931 Specification”
“ZHC4931 Wiring Instructions”
More details:
https://www.iotrouter.com/product21.html

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd III www.iotrouter.com

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 1www.iotrouter.com
1.Product Description
1.1 Product Introduction
ZHC4921 is a network IO product that supports 2 dry (wet) node detection, 1 relay
(COM, NO, NC) output, 1 analog (current 4 ~ 20mA) detection, and 1 serial port transparent
transmission. Compatible with Modbus RTU / TCP protocol. With "remote control" as the
core function and high ease of use, users can easily and quickly integrate into their own
systems to achieve remote control based on LTE networks.
1.2 Appearance
P 1
Antenna：GPS antenna (ZHC4931 supports GPS), MAIN (LTE network antenna).
SIM：Press the yellow dot next to the SIM card slot to eject the card tray and insert the SIM card.
DC5~30V（terminal block）：DC5~30V input.
RESET：Factory reset button
DC5~30V（DC Power Socket）：DC5~30V input.
WORK：Device running status indicator

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 2www.iotrouter.com
NET：Network status indicator/Network data receiving indicator
DATA：data transmission indicator
POW：Power indicator
RS485：RS485 interface.
RS232：RS232 interface.
DO：NC is normally closed, COM is common.
DI：DI1 ~ 2 are 2-way dry (wet) node detection, Shares one COM port.
AI: AI is 1 analog signal input.
2.Quick start
This chapter is a quick introduction to the ZHC4931 series products. It is recommended that
users read this chapter and follow the instructions once, and you will have a systematic
understanding of the equipment.
2.1 Hardware environment
Test data flow topological graph：
P 2 Test Data Flow Topological Graph

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 3www.iotrouter.com
Wiring: PC is connected to ZHC4931 via USB to RS485 tool.
Networking: Insert the SIM card before the device is powered on.
Power supply: DC5 ~ 30V.
After powering on, open the corresponding serial port, and then you can control the ZHC4931
through Modbus protocol.
2.2 USE
Chart 1 Test Initial Parameters
ITEM
Parameter
Network work
mode
TCP_Client(Network data transparent transmission)
Server Address
115.28.86.143
Server port
55000
Serial working
mode
Host mode
Serial parameters
Baud rate: 115200 Stop bits: 1 Data bits: 8 Parity bits: None
2.2.1 Serial control
Step 1：Open the setting software, select the correct serial port number, configure the correct
serial port parameters, and open the serial port.
P3 Set software serial port configuration

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 4www.iotrouter.com
Step 2: Click “Search”, the Modbus address code of the searched device will be displayed in the
device address bar. If the device address bar is empty, check the wiring.
P4 Search device
Step 3: Click “Get CFG” to get the current configuration of the device.
P5 Get Device Configuration

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 5www.iotrouter.com
Step 4: Click "Display" to open "Auto Refresh" to get the current status of the device
DO, DI, AI
P6 Obtaining device DO, DI, AI status
Step 5: Control DO relay output
P7 Control DO
2.2.1 Network control
For ZHC4921 network control function, please refer to
"ZHC4921 Cloud Transparent Transmission Instruction"

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 6www.iotrouter.com
3.Product Features
3.1.DO Output
For specific wiring, please refer to "ZHC4931 Wiring Process Manual".
Register address range：00017（0x0010）
Support function code: 01 (read coil), 05 (write single coil)
Enquiry：55 01 00 10 00 01 F1 DB
Query response：55 01 01 01 80 78
Control closure：55 05 00 10 FF 00 80 2B
Response：55 05 00 10 FF 00 80 2B
Control disconnect：55 05 00 10 00 00 C1 DB
Response：55 05 00 10 00 00 C1 DB
3.2.DI Input
3.2.1.Level detection
Register address range：10017~10020（0x0010~0x0013）
Support function code: 02 (read discrete input)
Detection level: The default state of xxxxxw is 1, and the state after input signal is 0. The
detection method is 02 function code of Modbus protocol.
Take the first detection as an example:
Enquiry: 55 02 00 10 00 01 B5 DB
Query response: (0 detected)：55 02 01 00 B1 B8

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 7www.iotrouter.com
Query response: (1 detected)：55 02 01 01 70 78
3.2.2.Pulse counting
Register address range：30049~30050（0x0030~0x0031）
Support function code: 04 (read discrete input)
Pulse counting：The default state of the product is 0. The input signal to the DI port counts
up by one. The detection method is to read the value of the pulse counter by the 04 function code
of the Modbus protocol. The maximum value of the pulse count is 65535. No more than 65535,
the user can modify the pulse count clear register to reset the pulse count.
Take the first detection as an example:
Enquiry：55 04 00 30 00 01 3C 11
Query response：（7 signal outputs detected）：55 04 02 00 07 C9 3E
3.2.3.Key detection
Register address range：30081~30082（0x0050~0x0051）
Support function code: 04 (read input register)
Key detection: The default state of the product is 0000, and the state after a key signal (press
+ pop) is FF00. The detection method is that the 04 function code of the Modbus protocol
reads the value of the key register. After the key register is read once, the state is restored to
0000. After the condition control is executed, the state is restored to 0000.
Take the detection of the first key as an example:
Enquiry：55 04 00 50 00 01 3C 0F
Query response: (with key action)：55 04 02 FF 00 C9 0C
Query response: (with key action)：55 04 02 00 00 88 FC
3.3.AI Input
For wiring method, please refer to "ZHC4921 Wiring Instructions"

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 8www.iotrouter.com
Calculation formula:
Current value = Return value / 1000 Unit: mA
Register address range：30017（0x0010）
Support function code: 04 (read input register)
Enquiry：55 04 00 10 00 01 3D DB
Query response：55 04 02 10 00 85 3C
The returned data is 0x1000, which means 4096uA, which is 4.096mA
3.4.Analog self-calibration
ZHC4931 supports user-defined calibration analog values.
AI Self-calibration register address：40531~40532（0x0212~0x0213）
Support function codes: 03 (read holding registers), 10 (write multiple holding registers)
Each analog self-calibration occupies two register addresses. For example, the two
addresses 0x0212 and 0x213 are AI 1 (current 1) self-calibration register addresses. The two
register values are 0x2710 and 0x2710 before delivery. The two registers before and after
represent the K and B values, respectively.
Calibration current calculation formula:
Current acquisition value = (K / 0x2710) * original current output value + (B-0x2710) * 10
Note：After V1008, K is the reference voltage and B is the power amplifier multiple.
The calibration formula is:
Actual value = sample value * K / 4096 / B, where K defaults to 3300mV and B
defaults to 50 times.
Write in：55 10 02 12 00 02 04 3A 98 26 48 E9 4A （K：15000、B：9800）
Write response：55 10 02 12 00 02 ED A1
Inquire：55 03 02 12 00 02 68 62
Query response：55 03 04 3A 98 26 48 78 97

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 9www.iotrouter.com
3.5 Active reporting
3.5.1.DO Active reporting
DO Active report enable register address：40017（0x0010）
Support function code:
03 (read holding register),06 (write a single holding register), 10 (write multiple holding registers)
Inquire：55 03 00 10 00 01 88 1B
Query response：55 03 02 FF FF 88 38（ON）/55 03 02 00 00 89 88（OFF）
Enable DO active reporting function,
Actively report the value of the enable register address to DO：0xFFFF
Inquire：55 06 00 10 FF FF 84 6B
Query response：55 06 00 10 FF FF 84 6B
OFF DO active reporting function,
Actively report the value of the enable register address to DO：0x0000
Write in：55 06 00 10 00 00 85 DB
Write response：55 06 00 10 00 00 85 DB
DO active reporting trigger condition:
DO active reporting is enabled and DO status changes.
In particular, when the "active report data trend" is set to Modbus TCP, the
transaction unit identifier is 0000
00 00 00 00 00 04 55 01 01 07
3.5.2.DI actively report
DI Active report enable register address：40273（0x0110）

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 10 www.iotrouter.com
Support function code:
03 (read holding register),06 (write a single holding register), 10 (write multiple holding registers)
Inquire：55 03 01 10 00 01 89 E7
Query response：55 03 02 FF FF 88 38（ON）/55 03 02 00 00 89 88（OFF）
Enable DI active reporting function,
Actively report the value of the enable register address to DI：0xFFFF
Write in：55 06 01 10 FF FF 85 97
Write response：55 06 01 10 FF FF 85 97
OFF DI active reporting function,
Actively report the value of the enable register address to DI：0x0000
Write in：55 06 01 10 00 00 84 27
Write response：55 06 01 10 00 00 84 27
DI active reporting trigger condition: DI active reporting is enabled and DI status changes
DI actively report that:
In particular, when the "active report data trend" is set to Modbus TCP, the transaction unit
identifier is 0000
00 00 00 00 00 04 55 02 01 07
3.5.3.AI actively reports
AI actively reports that:
Support settings : Timing + threshold reporting
The product reports regularly by default, with a lower threshold of 4000uA and an
upper threshold of 20000uA
Corresponding register address value reference:

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 11 www.iotrouter.com
Actively report data direction Register address value：0x0001
AI actively reports the enable register address value：0xFFFF
AI actively reports the period register address value:：0x000A
AI1 ~ AI4 report parameter register address value：00 01 0F A0 4E 20
If the AI acquisition value is not triggered,a Modbus RTU protocol message is sent to the
designated server address by port through the 4G network every 60s.
When AI enters the threshold, it will immediately pass the 4G network to the specified
server address, The port sends a Modbus RTU protocol message once and resets the period
Modbus RTU Message example：55 04 08 00 03 00 01 00 03 00 1A 4F 37
Modbus TCP Message example：00 00 00 00 00 0B 55 04 08 00 03 00 01 00 03 00 1A
AI Active report enable register address：40529（0x0210）
Support function code:
03 (read holding register),06 (write a single holding register), 10 (write multiple holding registers)
Inquire：55 03 02 10 00 01 89 A3
Query response：55 03 02 FF FF 88 38（ON）/55 03 02 00 00 89 88（OFF）
Enable AI active reporting function,
Actively report the value of the enable register address to AI：0xFFFF
Inquire：55 06 02 10 FF FF 85 D3
Query response：55 06 02 10 FF FF 85 D3
OFF AI active reporting function,
Actively report the value of the enable register address to AI：0x0000
Write in：55 06 02 10 00 00 84 63
Write response：55 06 02 10 00 00 84 63

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 12 www.iotrouter.com
AI Active report enable register address：40530（0x0211）
Support function code:
03 (read holding register),06 (write a single holding register), 10 (write multiple holding registers)
Inquire：55 03 02 11 00 01 D8 63
Query response：55 03 02 00 3C 89 99
Set AI active reporting period to 60s
Write in：55 06 02 11 00 3C D5 B2
Write response：55 06 02 11 00 3C D5 B2
AI Active report enable register address：40533~40535（0x0214~0x0216）
Support function code: 03 (read holding register) 10 (write multiple holding registers)
Inquire：55 03 02 14 00 03 49 A3
Query response： 55 03 06 00 01 0F A0 4E 20 E5 38
（Lower limit：
4000、 Upper limit： 20000）
Set lower threshold 5000, upper limit 15000
Write in：55 10 02 14 00 03 06 00 01 13 88 3A 98 C9 C8
Write response：55 10 02 14 00 03 CC 60

ZHC4931Manual Public
Chengdu Zongheng Intelligent Control Co., Ltd 13 www.iotrouter.com
3.6.Serial port
3.6.1.Operating mode
The device works in host mode by default.
Working mode register address:40785（0x0310）
Support function code:
03 (read holding register),06 (write a single holding register), 10 (write multiple holding registers)
Inquire：55 03 03 10 00 01 88 5F
Query response：55 03 02 00 02 08 49
Write in：55 06 03 10 00 01 44 5F
Write response：55 06 03 10 00 01 44 5F
A）HOST MODE
P 8 Host mode data flow graph